Field of the Invention
The invention relates to a method for controlling an internal combustion engine. A sensor is provided which senses an operating parameter of the internal combustion engine and generates a measurement signal. A control device comprises first and second arithmetic units in which a control program having a first, second and third program level is processed, wherein:
the first and second program levels are processed in the first arithmetic unit, and the third program level is divided between the first and second arithmetic units; PA1 at least one actuation signal for an actuator of the internal combustion engine is determined in the first program level as a function of the operating parameter; PA1 the actuation signal is monitored in the second program level, and a first emergency operating function is activated in the first program level if the second program level has detected implausibility in the actuation signal; and PA1 the first arithmetic unit is monitored in the third program level and the second program level is subjected to a runtime sequence check, and a second emergency operating function is carried out if the third program level detects an error. PA1 providing a sensor and sensing therewith an operating parameter of an internal combustion engine and generating a measurement signal; PA1 providing a control device with a first arithmetic unit and a second arithmetic unit for processing therein a control program having a first program level, a second program level, and a third program level; PA1 processing the first and second program levels in the first arithmetic unit, and dividing the third program level between the first and second arithmetic units; PA1 determining an actuation signal for an actuator of the internal combustion engine in the first program level in dependence on the operating parameter of the internal combustion engine; PA1 monitoring the actuation signal in the second program level, and activating a first emergency operating function in the first program level if the second program level detects an implausibility in the actuation signal; PA1 monitoring the first arithmetic unit in the third program level, and subjecting the second program level to a program sequence check, and carrying out a second emergency operating function if the third program level detects an error; and PA1 with the second program level, causing the third program level to carry out the second emergency operating function if, assuming that the first emergency operating function is being carried out in the first program level, the implausibility of the actuation signal continues to be detected.
A method for controlling an internal combustion engine is known from German published non-prosecuted patent application DE 44 38 714 A1. There, a control device that comprises a first and second arithmetic unit is assigned to the internal combustion engine. A control program has a first, second and third program level. The first and second program levels are processed in the first arithmetic unit. The third program level is divided between the first and second arithmetic units. At least one actuation signal for an actuator of the internal combustion engine is determined in the first program level as a function of an operating parameter. An emergency operating mode in the first program level is activated in the second program level if implausibility of the actuation signal is detected.
In the third program level, memory elements are tested and there is a sequence check of the second program level. A performance limitation is implemented if the third program level has detected an error.
If an emergency operating mode in the first program level is initiated by the second program level, the emergency operation is possibly in fact not carried out, or only carried out in an incorrect way. This is a high risk for the driving safety of a motor vehicle with the control device if the performance of the internal combustion engine is influenced by the actuator, since the third program level only monitors the second program level.
Furthermore, the disclosure DE 44 38 714 that a fault state which has been detected leads to a performance limitation by means of the third program level. However, in practice, the third program level has only little, or even no, information on the current values of the operating parameters. Accordingly, the performance limitation can then only be implemented by deactivating the internal combustion engine. However, this means a considerable loss in driving convenience and can result in an unnecessarily low reliability of the control device.